Monthly Archives: July 2015

NVD

CVE-2015-0725

Cisco Videoscape Distribution Suite Service Broker (aka VDS-SB), when a VDSM configuration on UCS is used, and Videoscape Distribution Suite for Internet Streaming (aka VDS-IS or CDS-IS) before 3.3.1 R7 and 4.x before 4.0.0 R4 allow remote attackers to cause a denial of service (device reload) via a crafted HTTP request, aka Bug IDs CSCus79834 and CSCuu63409.

NVD

CVE-2015-4528

Cross-site scripting (XSS) vulnerability in EMC Documentum CenterStage 1.2SP1 and 1.2SP2 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

NVD

CVE-2015-4529

Open redirect vulnerability in EMC Documentum WebTop before 6.8P02, Documentum Administrator before 7.2P01, Documentum Digital Assets Manager through 6.5SP6, Documentum Web Publishers through 6.5SP7, and Documentum Task Space through 6.7SP2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL.

NVD

CVE-2015-4460

Cross-site request forgery (CSRF) vulnerability in SecuritySetting/UserSecurity/UserManagement.aspx in B.A.S C2Box before 4.0.0 (r19171) allows remote attackers to hijack the authentication of administrators for requests that add administrator accounts via certain vectors.

Full Disclosure

double free's in glibc (and tcmalloc/jemalloc)

Posted by PIN on Jul 16

/* glibc fastbin / tcmalloc / jemalloc double destructor/free example
*
* This example demonstrates a pattern with a base type with a protected
* destructor so as to avoid glibc’s corruption of the vftable pointer,
* that exact condition does not exhibit itself with jemalloc, however
* there appears to be additional memory corruption in tcmalloc that
* leaves the heap in a less than stable state, however it was not
* further…

Full Disclosure

Broken, Abandoned, and Forgotten Code, Part 11

Posted by Zach C on Jul 16

Part 11 of Broken, Abandoned, and Forgotten Code is up! In this part,
we regenerate the SquashFS filesystem for our exploit firmware. We
have to shrink the firmware image down to 4MB from nearly 9MB to avoid
crashing the R6200’s UPnP daemon. We also add one more field to the
firmware header that, if absent, will cause the bootloader to hang.

Here’s a link to part 11:
http://shadow-file.blogspot.com/2015/07/abandoned-part-11.html

If…

Full Disclosure

Re: 15 TOTOLINK router models vulnerable to multiple RCEs

Posted by Joshua Wright on Jul 16

This was my morning LOL:

$ curl -O http://totolink.net/include/download.asp?path=down/010300&file=TOTOLINK%20N300RG_8_70.zip
$ unzip TOTOLINK N300RG_8_70.bin
$ binwalk -e TOTOLINK N300RG_8_70.bin

DECIMAL HEXADECIMAL DESCRIPTION
——————————————————————————–
0 0x0 uImage header, header size: 64 bytes, header CRC: 0xB0D462F0, created: 2013-08-19
07:55:35,…